jbarto (3)

Exchange Servers exposed to the outside (OWA) will need to patch this as soon as possible. Internal Exchange is not a high priority. The requirement of knowing the validation key is required to exploit. There is discussion that a specially crafted email may trigger this vulnerability with the way Exchange handles memory objects which can lead to remote code execution.
Several POC are available although the skill level to exploit is higher with the need to write custom code.
Recommended to patch if Exchange is exposed outside of the environment.
This was patched in the Feb 2020 patch release from Microsoft.
High/Critical depending on controls to expose Exchange to the internet.
Low/Moderate for internal Exchange depending on the environment.